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January 24,2019 

VIA EMAIL fidtheff{S),oaSpState.md,us) 



Office of the Attorney General 

Attn: Security Breach Notification 

200 St. Paul Place 

Baltimore, MD 21202 

Re; 

Data Incident Notification 


Dear Attorney General Frosh: 

Pursuant to Md. Code Ann., Com. Law § 14-3504 3 (the “Act”), we are writing to notify you of a 
potential breach of security of personal information ("PI”) related to two (2) Maryland residents. 

DeLacey Riebel Sc Shindell, LLP (the “Firm”) was victimized by a cyber attack (the "Incident”) 
that targeted the email account of one of it employees. On November 12, 2018, the Firm, through its extensive 
investigation of the Incident, determined that the cyber attacker may have accessed or acquired the emails in this 
account, a small subset of which contain PI related to two (2) Maryland residents. Specifically, these emails 
contained the name, date of birth, and driver’s license number of one of these residents, and the name, date of birth, 
and medical information of the other. 


The Firm commenced the foregoing investigation immediately upon learning of the Incident for 
the purpose of determining its scope, the impact on the Finn’s information systems, and the identity of those the 
Incident affected. The Firm, which engaged third patty experts to assist it with the investigation, determined that 
the attack occurred on June 18, 2018. The Firm has not found any evidence that the information contained in the 
affected emails was misused by the cyber attacker. 

Nevertheless, out of an abundance of caution, the Finn will provide notice to the affected 
individuals within the next few days so that they can take steps to minimize the risk that their information will be 
misused. Enclosed as Exhibit A is a copy of the template notice that the Firm will provide. As an added precaution, 
the Firm has arranged for Transllnion to provide to potentially affected individuals 12 months of free credit 
monitoring and related services. 

The Firm treats all sensitive information in a confidential manner and is proactive in the careful 
handling of such information. Since learning of the attack, the Firm has taken a number of steps to further secure 
its systems. Specifically, it has: forced password changes; conducted scans of all systems to ensure that they arc 
clear of viruses; trained Finn employees on recognizing and avoiding phishing emails; implemented a password- 
protected VPN for accessing the Firm’s files remotely; implemented backups to the Firm’s disaster recovery site, 
as well as backups onsite and to the cloud; and journaled emails to a third-party vendor, Global Relay. Additionally, 


Please note that the provision of this letter does not signify that the Firm agrees to the jurisdiction of the 
State of Maryland, or that it waives its right to challenge jurisdiction in any subsequent actions. 
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the Firm plans, moving forward, to require all remote desktop users to log in via the Firm's secure VPN connection, 
and to implement two-factor authentication when users connect to Firm desktops, 

*** 

Please feel free to contact me if you have questions or require additional information. 

Sincerely, 

JACKSON LEWIS P.C. 

Ajcmmfy AxIma 

Damon W. Silver 


Enclosure 
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